Privacy notice.

This website is run by Dermalogic Private Limited, trading as Dermalogic — Skin, Hair & Laser Clinic, a company registered in England and Wales. For the personal information described in this notice we are the data controller: we decide how and why it is used.

Company number

15731662 (opens in a new tab)

Registered office & clinic

162 Finchley Road, London NW3 5HE

Privacy contact

info@mydermalogic.com

Telephone

+44 7487 416555

ICO registration

ZC227072 (opens in a new tab)

Data protection officer

[DPO NAME AND CONTACT — or state that no DPO is appointed]

Information you give us at the clinic itself — your medical history, consultation notes, consent forms and clinical photographs — is not covered by this notice. We explain how we use it when you attend your consultation. [CLINIC TO PROVIDE: a written patient privacy notice for clinic records — then link it here]

We only collect what we need to reply to you and arrange a consultation:

• Contact details — first name, last name, email address and phone number.
• Your enquiry — the area of treatment you are interested in, any treatment or body area you choose to name, and a preferred date and time.
• Your confirmation that we may contact you about the enquiry.

The treatment you are interested in can say something about your health. That is why our forms ask only for a treatment area, and ask you not to send symptoms, medical history or photographs. We take your history in person, at the consultation.

We do not use this website to make automated decisions about you, and we do not build profiles of visitors.

When you send the enquiry form on our contact page or home page, we use your details to reply to your enquiry and to arrange a consultation if you want one.

Lawful basis

[LAWFUL BASIS FOR ENQUIRIES — to be confirmed by the clinic’s data protection lead or lawyer]

Where the treatment area reveals health information

[UK GDPR ARTICLE 9 CONDITION — to be confirmed]

Where enquiries are delivered and stored

Each enquiry is passed by FormSubmit (formsubmit.co), a form-forwarding service, to our clinic inbox, info@mydermalogic.com, provided by Zoho Mail.

We use your details only for your enquiry. We will not add you to a mailing list or send you marketing because you sent an enquiry. We do not send marketing emails, texts or WhatsApp messages.

The “Book” buttons on this website take you to our booking page on Vagaro, a third-party appointment service run by Vagaro, Inc. in the United States. The details you enter there — such as your name, contact details and the treatment you book — are collected through Vagaro’s system to manage your appointment for us.

Vagaro’s role

Vagaro acts on our behalf under a written agreement that governs how it handles your information.

Lawful basis for managing appointments

[LAWFUL BASIS FOR BOOKINGS — to be confirmed]

Vagaro’s own policy

Vagaro’s own privacy policy also applies to your use of its site and app.

Nothing is sent to Vagaro from this website until you choose to follow a booking link.

Before you choose a time, you pay online through Stripe, a payment service run by Stripe Payments Europe, Ltd: the £50 consultation fee when you book a consultation, or a £20 deposit when you book treatment sessions. Stripe collects your card details, name, email address and phone number on its own secure payment page; we never see or store your card number. We receive your name, contact details, the amount and what you are booking, so we can match your payment to your appointment. The £20 deposit is a deposit, not an extra charge.

Stripe’s role

Stripe processes the payment for us and is also responsible for meeting its own legal duties, such as fraud prevention.

Lawful basis for taking payment

[LAWFUL BASIS FOR BOOKING PAYMENTS — to be confirmed; usually contract]

Stripe’s own policy

Stripe’s privacy policy (stripe.com/privacy) also applies to the payment page.

If you call us or email info@mydermalogic.com, we use what you tell us to answer your question and, if you want, to arrange an appointment. Our email is provided by Zoho Mail (Zoho Corporation), using its EU data centre.

Photographs of identifiable patients are health information. We only publish a before-and-after photograph on this website with that person’s written consent for it to be shown online. They can withdraw that consent at any time, and we will then remove the photograph from this website.

• Hosting

  This website is hosted and delivered by Cloudflare. Like any web server, it receives your IP address and basic browser information in order to send you each page, and may keep these in security logs for [SERVER LOG RETENTION].

• Fonts

  Our fonts are served from this website itself. Your browser does not contact Google Fonts or any other font service.

• Analytics

  If you accept analytics cookies, we use Google Analytics to count visits, see which pages are useful, how far down a page people read, and which buttons are used (such as Book, Call or sending an enquiry — never what you typed). Google receives your IP address and browser details; we see only combined figures, never who you are. Google signals and ad personalisation are switched off, and we do not use advertising or social-media tracking tools. If you reject or ignore the question, Google Analytics is not loaded.

• Map

  The map on our contact page is not loaded unless you choose “Show interactive map”. If you do, it is loaded from Google, which receives your IP address and may set its own cookies; Google’s privacy policy then applies. The “Open in Google Maps” and “Get directions” links take you to Google’s own site.

• Social media

  Our Instagram, Facebook, LinkedIn and TikTok links are plain links. Nothing is shared with those services unless you click through, and their own privacy policies then apply.

No cookies are set unless you accept analytics — and you can change your mind at any time.

On your first visit we ask whether we may use analytics cookies. Nothing optional is set until you answer, and “Reject” is as easy as “Accept”. We do not use tracking pixels or advertising cookies.

To change your choice, use Cookie settings (also at the foot of every page). Withdrawing consent stops Google Analytics and deletes its cookies from this site. Google Analytics keeps the visit data it has already collected for [CLINIC TO CONFIRM: GA data-retention setting, e.g. 14 months].

Third parties may set their own cookies only when you choose to use them: the interactive Google map (see section 7) and our Vagaro booking pages. If we add any other cookie that is not strictly necessary, we will ask for your consent before setting it and update this notice.

We do not sell your personal information. We share it only with the service providers that help us run the clinic and this website, who may use it only on our instructions:

We may also disclose information where the law requires it, for example to a regulator or the police.

Some of our providers, including Vagaro and Cloudflare, may store or access your information outside the UK. Where they do, we rely on [TRANSFER SAFEGUARD — e.g. UK adequacy regulations, the UK–US data bridge, or the ICO International Data Transfer Agreement; to be confirmed for each provider]. You can ask us for details of these safeguards using the contact details in section 1.

Website enquiries that do not lead to an appointment

12 months from your last contact with us

Booking records

[DATA RETENTION PERIOD — BOOKINGS]

Emails

12 months from your last contact with us, unless the email becomes part of your patient record

Patient records created at the clinic

Kept as set out in our patient privacy notice.

When a period ends, we delete or anonymise the information.

This website is served only over an encrypted (HTTPS) connection. Our forms send your details in the body of an encrypted request, never in the web address. Nothing you type into them is stored in your browser. Access to enquiries and bookings is limited to the clinic staff who need it. [CLINIC TO CONFIRM any further measures, e.g. two-factor sign-in on Vagaro and email]

Under UK data protection law you have the right to:

• AccessSee the personal information we hold about you, and get a copy.
• CorrectionHave inaccurate information corrected.
• ErasureHave your information erased, where we no longer have a reason to keep it.
• RestrictionRestrict how we use it while a concern is looked into.
• ObjectionObject to our use of it, where we rely on legitimate interests.
• PortabilityReceive information you gave us in a portable format, where that right applies.
• Withdraw consentAt any time, where we rely on your consent. This does not affect what we did before you withdrew it.

To use any of these rights, email info@mydermalogic.com or call +44 7487 416555. It is free. We may need to confirm your identity first. We reply within one month, and will tell you within that month if a complex request needs up to two months longer.

If you are unhappy with how we have used your information, please tell us first using the details in section 1 and we will try to put it right.

We will update this notice when the way we use personal information changes. The date below shows when it was last revised.

Last updated: [DATE OF APPROVAL]